U.S. patent application number 16/189126 was filed with the patent office on 2019-03-28 for secure remote aggregation.
The applicant listed for this patent is ABB Schweiz AG. Invention is credited to Matus Harvan, Thomas Locher, Sebastian Obermeier, Yvonne-Anne Pignolet, Johannes Schneider.
Application Number | 20190097787 16/189126 |
Document ID | / |
Family ID | 56008498 |
Filed Date | 2019-03-28 |
![](/patent/app/20190097787/US20190097787A1-20190328-D00000.png)
![](/patent/app/20190097787/US20190097787A1-20190328-D00001.png)
United States Patent
Application |
20190097787 |
Kind Code |
A1 |
Schneider; Johannes ; et
al. |
March 28, 2019 |
SECURE REMOTE AGGREGATION
Abstract
The invention relates to a method for aggregation of a
performance indicator of a device comprising the steps of:
concatenating a respective first data item to a plurality of second
data items in the device; encrypting the plurality of concatenated
second data items relevant for computing the performance indicator
using a first encryption key in the device, wherein the first
encryption key is based on an additive homomorphic encryption
scheme; sending the encrypted concatenated second data items to a
computation cluster; computing the performance indicator on the
computation cluster using the encrypted concatenated second data
items and computing an aggregate value regarding the performance
indicator by summing up the encrypted concatenated second data
items; sending the aggregate value to a server of a service
provider of the device; decrypting the aggregate value using a
second encryption key on the server of the service provider; and
verifying the decrypted result by checking whether the decrypted
sum computed by summing up the encrypted concatenated second data
items comprises a predetermined value. The present invention also
relates to a corresponding system and corresponding computer
program product comprising one or more computer readable media
having computer executable instructions for performing the steps of
the method.
Inventors: |
Schneider; Johannes;
(Fislisbach, CH) ; Harvan; Matus; (Zurich, CH)
; Obermeier; Sebastian; (Schinznach-Dorf, CH) ;
Locher; Thomas; (Zurich, CH) ; Pignolet;
Yvonne-Anne; (Zurich, CH) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
ABB Schweiz AG |
Baden |
|
CH |
|
|
Family ID: |
56008498 |
Appl. No.: |
16/189126 |
Filed: |
November 13, 2018 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
PCT/EP2017/000609 |
May 8, 2017 |
|
|
|
16189126 |
|
|
|
|
Current U.S.
Class: |
1/1 |
Current CPC
Class: |
H04L 2209/46 20130101;
H04L 2209/76 20130101; H04L 9/008 20130101 |
International
Class: |
H04L 9/00 20060101
H04L009/00 |
Foreign Application Data
Date |
Code |
Application Number |
May 13, 2016 |
EP |
16169600,0 |
Claims
1. A method for aggregation of a performance indicator of a device
comprising the steps of: a) concatenating a respective first data
item to a plurality of second data items in the device; b)
encrypting the plurality of concatenated second data items relevant
for computing the performance indicator using a first encryption
key in the device, wherein the first encryption key is based on an
additive homomorphic encryption scheme; c) sending the encrypted
concatenated second data items to a computation cluster; d)
computing the performance indicator on the computation cluster
using the encrypted concatenated second data items and computing an
aggregate value regarding the performance indicator by summing up
the encrypted concatenated second data items; e) sending the
aggregate value to a server of a service provider of the device; f)
decrypting the aggregate value using a second encryption key on the
server of the service provider; and g) verifying the decrypted
result by checking whether the decrypted sum computed by summing up
the encrypted concatenated second data items comprises a
predetermined value.
2. The method according to claim 1, wherein the first data item is
or comprises at least one number of at least one set of numbers N
{1 . . . m} and the predefined value is m(m+1)/2.
3. (canceled)
4. The method according to claim 1, wherein the second encryption
key is only configured to decrypt the aggregate value.
5. The method according to claim 1, wherein the aggregate value is
computed by further performing at least one of the following
functions: computing the average of the encrypted concatenated
second data items, computing the variance of the encrypted
concatenated second data items, and computing the weighted sums of
the encrypted concatenated second data items.
6. The method according to claim 1, further comprising the
following steps between step c) and d): sending the aggregate value
to a user of the electronic device, the electronic device or a
second provider; decrypting the aggregate value; and encrypting the
aggregate value with an encryption key being different from the
first encryption key, and wherein step d) comprises the step of
sending the re-encrypted aggregate value to the provider of the
device.
7. The method according to claim 1, wherein the second encryption
key is based on a stateful encryption scheme.
8. The method according to claim 1, wherein the performance
indicator is the averaged temperature of the device.
9. A system for aggregation of a performance indicator of a device
comprising: the device, wherein the device is configured to
concatenate a respective first data item to a plurality of second
data items and is configured to encrypt the plurality of
concatenated second data items relevant for the computation of the
performance indicator of the device using a first encryption key,
wherein the first encryption key is based on an additive
homomorphic encryption scheme, a sending unit configured to send
the encrypted concatenated second data items to a computation
cluster; the computation cluster being configured to compute the
performance indicator of the at least one device using the
encrypted concatenated second data items and configured to compute
an aggregate value regarding the performance indicator by summing
up the encrypted concatenated second data items; and a sending unit
configured to send the aggregate value to a server of the service
provider of the device, wherein the system further comprises the
server of the service being configured to decrypt the aggregate
value using a second encryption key, and wherein the system further
comprises a verification unit being configured to verify the
decrypted result by checking whether the decrypted sum computed by
summing up the encrypted concatenated second data items comprises a
predetermined value.
10. The system according to claim 9, wherein the first data items
is or comprises -at least one number of at least one set of numbers
N {1 . . . m} and the predefined--value is--m(m+1)/2.
11. (canceled)
12. The system according to claim 9, wherein the computation
cluster is configured to compute aggregate values by further
performing at least one of the following functions: computing the
average of the encrypted concatenated second data items, computing
the variance of the encrypted concatenated second data items, and
computing the weighted sums of the encrypted concatenated second
data items.
13. The system according to claim 9, wherein the sending unit is
configured to send the aggregate value to a user of the electronic
device, the electronic device or a second provider, wherein the
user of the electronic device, the electronic device or the second
provider is configured to decrypt the aggregate value and is
configured to encrypt the aggregate value with an encryption key
being different from the first encryption key, and wherein the
sending unit is configured to send the re-encrypted aggregate value
to the server of the service provider of the device.
14. The system according to claim 9, wherein the second encryption
key is based on a stateful encryption scheme and wherein the server
of the service provider is configured to decrypt the aggregate
value using the second encryption key.
15. A computer readable media for aggregation of a performance
indicator of a device comprising: concatenating a respective first
data item to a plurality of second data items in the device;
encrypting the plurality of concatenated second data items relevant
for computing the performance indicator using a first encryption
key in the device, wherein the first encryption key is based on an
additive homomorphic encryption scheme; sending the encrypted
concatenated second data items to a computation cluster; computing
the performance indicator on the computation cluster using the
encrypted concatenated second data items and computing an aggregate
value regarding the performance indicator by summing up the
encrypted concatenated second data items; sending the aggregate
value to a server of a service provider of the device; decrypting
the aggregate value using a second encryption key on the server of
the service provider; and verifying the decrypted result by
checking whether the decrypted sum computed by summing up the
encrypted concatenated second data items comprises a predetermined
value.
16. The method according to claim 1, wherein the first data item
includes, is part, is at least one value of or comprises at least
one value of a protection function for the integrity of the
computation.
17. The system according to claim 9, wherein the first data item
includes, is part, is at least one value of or comprises at least
one value of a protection function for the integrity of the
computation.
18. The method according to claim 2, wherein the second encryption
key is only configured to decrypt the aggregate value.
19. The method according to claim 2, wherein the aggregate value is
computed by further performing at least one of the following
functions: computing the average of the encrypted concatenated
second data items, computing the variance of the encrypted
concatenated second data items, and computing the weighted sums of
the encrypted concatenated second data items.
20. The method according to claim 4, wherein the aggregate value is
computed by further performing at least one of the following
functions: computing the average of the encrypted concatenated
second data items, computing the variance of the encrypted
concatenated second data items, and computing the weighted sums of
the encrypted concatenated second data items.
21. The method according to claim 2, further comprising the
following steps between step c) and d): sending the aggregate value
to a user of the electronic device, the electronic device or a
second provider; decrypting the aggregate value; and encrypting the
aggregate value with an encryption key being different from the
first encryption key, and wherein step d) comprises the step of
sending the re-encrypted aggregate value to the provider of the
device.
22. The method according to claim 4, further comprising the
following steps between step c) and d): sending the aggregate value
to a user of the electronic device, the electronic device or a
second provider; decrypting the aggregate value; and encrypting the
aggregate value with an encryption key being different from the
first encryption key, and wherein step d) comprises the step of
sending the re-encrypted aggregate value to the provider of the
device.
Description
FIELD OF THE INVENTION
[0001] The invention relates to a method and a system for
aggregation of a performance indicator of a device. The invention
particularly relates to a method and a system for aggregation of a
performance indicator for fleets of devices.
BACKGROUND OF THE INVENTION
[0002] The trend towards remote storage and analysis of data leads
to the development of platforms providing a central infrastructure
that manages the remote connection to customers, offers storage for
collected data, and can perform analytics on the collected data.
One crucial aspect of such platforms is confidentiality and
integrity, i.e., the platform should not learn anything about the
data it stores and processes, while executing aggregation and other
functions on the data.
[0003] The difficulty of achieving this goal increases when there
are several users, which neither trust each other nor the storage
and processing platform, yet functions across all users must be
carried out. A specific case of this problem is fleet management. A
fleet is a set of serviced products/systems of the same type that
are managed together, e.g., by a single asset owner. In particular
this concerns the scenario where several customers provide
encrypted data to a particular platform, which in turn computes key
performance indicators, KPIs, across this data without learning
more than the computed aggregate values. In this context KPIs,
hereinafter also referred to as performance indicator, refer to any
aggregate function over any set of the device's output data or over
any set of performance data relating to the device itself.
[0004] In particular, product line managers at a company with a
multi-vendor strategy who are responsible for a fleet of products
would like to aggregate/compose/combine the results of individual
asset health checks of the equipment by the equipment type. This
allows the product line managers to know at any point in time how
the fleet is performing and which members of the fleet require
attention. This information helps to rapidly respond to inquiries
from management, schedule maintenance actions, and also to compare
their fleet with those of competitors.
[0005] This use case is different from classic remote data
processing since every customer ideally encrypts their data with
their own private key, yet the service provider should be able to
derive actionable insights from this information. In contrast to
traditional multi-party computation, the customers should be
involved as little as possible. In the ideal case, they provide
input only and are not needed for further interactions.
[0006] Privacy is considered to be a key requirement by customers.
In the chemical industry, for example, chemical reactions are well
known, but the customers consider the intellectual property to be
the production process. For such applications, even the lead
provider is not allowed to view individual parameters, which makes
fleet management of the data very difficult.
[0007] There is a lot of related work on privacy-preserving
outsourcing of computation. However, the mechanisms found in the
literature have either different scenarios, weaker security
assumptions or higher complexity, e.g., in terms of the required
communication between all parties.
[0008] [1] relates to efficient outsourcing multi-party computation
being based on the assumption that all parties are "semi-honest",
i.e., they faithfully execute the given protocols and only collect
information that is accessible to them. However, it is not assumed
that an attacker can also actively try to gather information, e.g.,
by misusing the protocols.
[0009] A scheme based on "multi-key fully homomorphic encryption"
has also been proposed in [2] that does not require many
communication rounds; however, the decryption phase is interactive
and the computational overhead is large [2].
[0010] The journal contribution of Rafik et al., "SA-SPKC: Secure
and efficient aggregation scheme for wireless sensor networks using
stateful public key cryptography", IEEE Programming and Systems
(ISPS), 2013 11th International Symposium, p. 96-102, relates to
data aggregation in wireless sensor networks and a respective
security protocol which addresses the security services for the
wireless sensor networks wherein only the base station can verify
the individual data and identify the malicious node.
[0011] The journal contribution of Lu et al., "EPPA: An Efficient
and Privacy-Preserving Aggregation Scheme for Secure Smart Grid
Communications", IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED
SYSTEMS, 2012, p. 1621-1631, relates to an aggregation scheme for
secure smart grid communications.
DESCRIPTION OF THE INVENTION
[0012] The present invention addresses the problem of handling the
data of a fleet of devices in a secure manner. To this end, data is
stored and processed in an untrusted third-party platform, i.e. a
cloud, is necessary. The platform must not learn about individual
data items; however, it must be able to compute aggregates over the
data, which it can make available to the service provider. The
service provider can use these aggregates to determine usage and
performance metrics for its devices without learning any
fine-grained information about the data from each device.
[0013] Concerns about privacy are a significant roadblock to the
adoption of fleet management. Thus, it is an objective of the
present invention to facilitate the adoption of fleet management
systems by providing strong protection of user data.
[0014] It is an objective of the present invention to offer
security for the user of devices which are connected to a
computation cluster, i.e. a cloud, that goes beyond the security
guarantees of cloud providers which typically only protect the
communication between the customers and the cloud and the data at
rest in the cloud. However, the cloud provider typically has the
decryption keys to examine all data and could illicitly use
them.
[0015] These and other objectives are achieved by a method, a
system and a computer program product according to the independent
claims. Preferred embodiments are evident from the dependent patent
claims.
[0016] In particular, the invention offers the following security
features: [0017] 1. The service provider does not learn more than
the aggregates even if it colludes with the computation cluster.
[0018] 2. If the computation cluster and the service provider do
not collude, then the computation cluster does not learn anything
about the aggregates or individual data items. [0019] 3. The
service provider can verify that the computation cluster carried
out the functions correctly.
[0020] The present invention paves the way for new services because
customers can verify the involved cryptographic algorithms and
therefore be sure that the provider of the fleet of devices cannot
trace individual values, but is still able to analyze the data for
the customer.
[0021] The present invention relates to a method for aggregation of
a performance indicator of a device comprising the steps of: [0022]
a) concatenating a respective first data item to a plurality of
second data items in the device; [0023] b) encrypting the plurality
of concatenated second data items relevant for computing the
performance indicator using a first encryption key in the device,
wherein the first encryption key is based on an additive
homomorphic encryption scheme; [0024] c) sending the encrypted
concatenated second data items to a computation cluster; [0025] d)
computing the performance indicator on the computation cluster
using the encrypted concatenated second data items and computing an
aggregate value regarding the performance indicator by summing up
the encrypted concatenated second data items; [0026] e) sending the
aggregate value to a server of a service provider of the device;
[0027] f) decrypting the aggregate value using a second encryption
key on the server of the service provider; and [0028] g) verifying
the decrypted result by checking whether the decrypted sum computed
by summing up the encrypted concatenated second data items
comprises a predetermined value.
[0029] Preferably, the first data item comprises or is at least one
number of at least one set of numbers N {1 . . . m}. In other
words, preferably, step a) comprises concatenating a respective set
of numbers N {1 . . . m} to the plurality of second data items in
the device. Preferably, the predefined value is m(m+1)/2.
Preferably, each number 1, . . . , m occurs exactly once. This
ensures that the sum is m(m+1)/2. Preferably, multiple numbers are
added so that the sum for each added number becomes m(m-1)/2.
[0030] Preferably, the first data item includes, is part, is at
least one value of or comprises at least one value of a protection
function for the integrity of the computation. In other words,
preferably, the (respective) first data item is configured to allow
to ensure the protection of the integrity of the computation.
[0031] Preferably, the second encryption key is only configured to
decrypt the aggregate value.
[0032] Preferably, the second encryption key is also based on the
homomorphic encryption scheme.
[0033] Preferably, the method further comprises the step of
encrypting a plurality of concatenated second data items relevant
for computing the performance indicator using a third encryption
key in a second device and wherein the performance indicator on the
computation cluster is computed using the encrypted concatenated
second data items of the device and the second device and the
aggregate value regarding the performance indicator is computed on
the basis of the encrypted concatenated second data items of the
device and the second device.
[0034] Preferably, the aggregate value is computed by further
performing at least one of the following functions: computing the
average of the encrypted concatenated second data items, computing
the variance of the encrypted concatenated second data items, and
computing the weighted sums of the encrypted concatenated second
data items.
[0035] Preferably, the method further comprises the step before
step a) of concatenating the plaintext to be encrypted with
verification numbers, wherein the verification numbers are
preferably randomly chosen from a predefined set of numbers.
[0036] Preferably, the verification of the decrypted result after
step e) is based on checking whether the verification number part
of the decrypted plaintext is equal a certain value. Preferably,
the certain value depends on the function used for computing the
performance indicator.
[0037] Preferably, the method further comprises the following steps
between step c) and d):
[0038] sending the aggregate value to a user of the electronic
device, the electronic device or a second provider;
[0039] decrypting the aggregate value regarding the performance
indicator; and
[0040] encrypting the aggregate value regarding the performance
indicator with a key being different from the first encryption key,
and wherein step d) comprises the step of sending the re-encrypted
aggregate value regarding the performance indicator to the service
provider of the device.
[0041] Preferably, the second encryption key is based on a stateful
encryption scheme.
[0042] With stateful encryption it is possible to give the service
provider a key that only allows the decryption of sums, but not of
the individual values. Preferably, the encryption of the m first
data items--in case the first data item is or comprises at least
one number of at least one set of numbers N {1 . . . m}--is
performed by adding a random value kj to the jth data item, where
.SIGMA.i kj=K. If the service provider knows K, K can be subtracted
from the obtained result to get the sum of the data items.
[0043] Preferably, the performance indicator is the averaged
temperature of the at least one device. Preferably, the performance
indicator is at least one of the following: pressure, humidity,
torque, force, noise level, voltage, amperage or accumulated events
such as number of anomalous events, number of faults or the
like.
[0044] The invention also refers to a system for aggregation of a
performance indicator of a device comprising: the device, wherein
the device is configured to concatenate a respective first data
item to a plurality of second data items and is configured to
encrypt a plurality of concatenated second data items relevant for
the computation of the performance indicator of the device using a
first encryption key, wherein the first encryption key is based on
an additive homomorphic encryption scheme, a sending unit
configured to send the encrypted concatenated second data items to
a computation cluster; the computation cluster being configured to
compute the performance indicator of the device using the encrypted
concatenated second data items and being configured to compute an
aggregate value regarding the performance indicator by summing up
the encrypted concatenated second data items; and a sending unit
configured to send the aggregate value to a server of the service
provider of the device, wherein the system further comprises the
server of the service provider being configured to decrypt the
aggregate value using a second encryption key and wherein the
system further comprises a verification unit being configured to
verify the decrypted result by checking whether the decrypted sum
computed by summing up the encrypted concatenated second data items
comprises a predetermined value.
[0045] Preferably, the system further comprises a second device
being configured to encrypt a plurality of concatenated second data
items relevant for computing the performance indicator using a
third encryption key. Preferably, the computation cluster is
configured to compute the performance indicator using the encrypted
concatenated second data items of the device and the second device
and is configured to compute the aggregate value regarding the
performance indicator on the basis of the encrypted concatenated
second data items of the device and the second device.
[0046] Preferably, the computation cluster is configured to compute
the aggregate value by further performing at least one of the
following functions: computing the average of the encrypted
concatenated second data items, computing the variance of the
encrypted concatenated second data items, and computing the
weighted sums of the encrypted concatenated second data items. In
this context, the average of the encrypted concatenated second data
items preferably refers to a pair, i.e. the sum and a count. In
addition, the variance also preferably refers to a pair, i.e. the
sum of squared values and the sum of values squared.
[0047] Preferably, the sending unit is configured to send the
aggregate value to a user of the electronic device, the electronic
device or a second provider.
[0048] Preferably, the user of the electronic device, the
electronic device or the second provider is configured to decrypt
the aggregate value and is configured to encrypt the aggregate
value with an encryption key being different from the first
encryption key.
[0049] Preferably, the sending unit is configured to send the
re-encrypted aggregate value to the server of the service provider
of the device.
[0050] Preferably, the second encryption key is based on a stateful
encryption scheme.
[0051] Preferably, the server of the service provider is configured
to decrypt the aggregate value using the second encryption key.
BRIEF DESCRIPTION OF THE DRAWINGS
[0052] The subject matter of the invention will be explained in
more detail in the following text with reference to preferred
exemplary embodiments which are illustrated in the attached
drawings, in which:
[0053] FIG. 1 schematically shows a system for aggregation of a
performance indicator of a device according to an embodiment of the
present invention.
[0054] The reference symbols used in the drawings, and their
primary meanings, are listed in summary form in the list of
designations. In principle, identical parts are provided with the
same reference symbols in the figures.
DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
[0055] FIG. 1 schematically shows a system for aggregation of a
performance indicator of a device 101-10n.
[0056] The system comprises a fleet of devices 100 and a
computation cluster 200. The fleet of devices 100 comprises a
plurality of devices 101 to 10n. However, it is understood for the
skilled person that the present invention also refers to cases
where only one device is present. The fleet of devices 100 may be
of the same or different devices. At least one device, e.g. the
device 101, of the plurality of devices 101 to 10n a) concatenates
a respective first data item to a plurality of second data items.
In this embodiment, the first data item includes at least one set
of numbers N {1 . . . m}. Then, the device 101 encrypts the
plurality of concatenated second data items relevant for computing
a performance indicator, e.g. the average temperature, using a
first encryption key. The first encryption key is based on an
additive homomorphic encryption scheme. The device 101 sends the
encrypted concatenated second data items to the computation cluster
200, hereinafter referred to as the cloud 200.
[0057] The cloud 200 computes the performance indicator, i.e. the
average temperature in this embodiment, and also computes an
aggregate value regarding the average temperature.
[0058] Then, the cloud 200 sends the aggregate value to a provider
300 of the fleet of devices 100.
[0059] The provider 300 of the fleet of devices 100 decrypts the
aggregate value using a second encryption key wherein the second
encryption key is only capable of decrypting the aggregate value
but not the performance indicator itself. In other words, the
second encryption key can only decrypt aggregate values but not
individual values.
[0060] The present invention provides aggregation of one or more
performance indicators over A) a large number of data items for an
individual device, so-called temporal aggregation, and/or B) a
large number of devices, so-called spatial aggregation. However, it
is understood by the skilled person that any combination of
temporal and spatial aggregation is possible.
[0061] In the following, the temporal aggregation and the spatial
aggregation are explained:
[0062] A) Temporal aggregation [0063] For temporal aggregation,
i.e. aggregation of data from one device over a predefined time
window, exemplarily embodiments are hereinafter described where
additive homomorphic encryption is used for encryption. All
concatenated second data items that are sent to the cloud 200 and
that the cloud 100 processes for temporal aggregations are
encrypted under the same key. For re-encryption there are three
options. [0064] a) The computation cluster 200 sends the encrypted
result of the aggregation, i.e. the aggregate value, which is
optionally blinded, to the device 101, which then decrypts the
aggregate value, verifies and re-encrypts the aggregate value with
the public key of the service provider 300. Afterwards, the
re-encrypted aggregate value is sent by the device 101 to the
service provider 300. [0065] b) With stateful encryption it is
possible to give the service provider 300 a key that only allows
the decryption of sums, but not of the individual values. As an
example, in case the first data item is or comprises at least one
set of numbers N {1 . . . m}, the encryption of the m data items by
adding a random value k.sub.j to the jth data item is considered,
with .SIGMA..sub.j k.sub.j=K. If the service provider 300 knows K,
it can subtract K from the obtained result to get the sum of the
data items. [0066] c) A party, which does not collude with the
computation cluster, e.g. a second provider is given a
proxy-re-encryption key for the service provider. The computation
cluster 200 sends a blinded result/aggregate value to this party.
If the verification process succeeds, it carries out the
re-encryption of the aggregate value with the service provider's
key and sends the aggregate value back to the computation cluster
200. The computation cluster 200 then removes the blind and
forwards the result to the service provider 300.
[0067] B) Spatial Aggregation
[0068] For spatial aggregation, i.e. aggregation of data at time t
over a set of devices, it has to be considered that data items may
be encrypted under different keys for each device 101 to 10n.
[0069] In order to enable the computation cluster 200 to calculate
the aggregate value, e.g. the sum of the performance indicator,
according to this embodiment, either (i) there exists an operation
to ensure that ciphertexts are encrypted under the same key or (ii)
the encryption scheme must offer an operation on the keys to derive
the key under which the ciphertext of the sum is encrypted. [0070]
An embodiment of the present invention dealing with (i) uses the
fact that the BCP scheme [3] has the following property: Let
k=k.sub.1+k.sub.2. For a data item d it holds that an encryption of
d under the key k can be decrypted by running the decryption
operations once with k.sub.1 and then once by k.sub.2, i.e.,
d=D(k.sub.2, D(k.sub.1, E(k, m)). In this case, a non-colluding
third party, e.g. a 2.sup.nd service provider, can be given a key k
which is unknown to the computation cluster 200. Each device 101 to
10n being involved in the process generates a random number k, and
sends it to the computation cluster 200. The private keys pk.sub.j
of the devices 101 to 10n can then be computed by adding k.sub.j to
k. In other words, pk=k_i+k, i.e. k_i is computed based on the
device's 100 private key and the cloud's 200 key k. All devices 101
to 10n encrypt their data items with their keys pk.sub.j and send
them to the computation cluster 200, which in turn runs one
decryption operation with k.sub.j1. This ensures that all values
are encrypted under the third parties key k. For the remaining
steps the procedures for temporal aggregation can be used. [0071]
In an embodiment using (ii) each device 101 to 10n blinds its data
item(s) with a random value x.sub.j which is encrypted under the
public key of a non-colluding third party. In other words, a pair
is sent, the blinded data item, and also the encrypted blind. The
computation cluster 200 can sum up both the blinded data items and
the encrypted random values and send a blinded version of these
sums to the third party. The third party can thus decrypt the sum
of the random values, subtract it from the sum of the blinded data
items if the verification of the random values is successful and
then re-encrypt the result for the service provider 300. The
computation cluster 200 removes the blind from the result, i.e. the
aggregate value, and forwards it to the service provider 300.
[0072] While the invention has been described in detail in the
drawings and foregoing description, such description is to be
considered illustrative or exemplary and not restrictive.
Variations to the disclosed embodiments can be understood and
effected by those skilled in the art and practising the claimed
invention, from a study of the drawings, the disclosure, and the
appended claims. In the claims, the word "comprising" does not
exclude other elements or steps, and the indefinite article "a" or
"an" does not exclude a plurality. The mere fact that certain
elements or steps are recited in distinct claims does not indicate
that a combination of these elements or steps cannot be used to
advantage, specifically, in addition to the actual claim
dependency, any further meaningful claim combination shall be
considered disclosed.
LIST OF DESIGNATIONS
[0073] 100--Fleet of devices
[0074] 101--10n Device
[0075] 200--Computation Cluster
[0076] 300--Service Provider
REFERENCES
[0077] [1]--Peter, Adrian, Erik Tews, and Stefan Katzenbeisser.
"Efficiently Outsourcing Multiparty Computation under Multiple
Keys." Information Forensics and Security, IEEE Transactions on 8,
no. 12 (2013): 2046-2058.
[0078] [2]--Lopez-Alt, Adriana, Eran Tromer, and Vinod
Vaikuntanathan. "On-the-fly Multiparty Computation on the Cloud via
Multikey Fully Homomorphic Encryption." Proceedings of the
forty-fourth Annual ACM Symposium on Theory of Computing STOC),
2012.
[0079] [3]--Bresson, Emmanuel, Dario Catalano, and David
Pointcheval. "A Simple Public-Key Cryptosystem with a Double
Trapdoor Decryption Mechanism and its Applications." In Advances in
Cryptology-ASIACRYPT 2003, pp. 37-54.
* * * * *